Cheat Engine

[random5566]

Hi, been trying to hack dma protected games with CheatEngine with no luck, even after following all the tutorials.

I know the hardest part about making a DMA tutorial, is finding a good example of a program/game that is easily accessible to anyone who would like to follow the tutorial.

So, I made a little program in GameMaker that utilizes DMA dynamic memory allocation. Could some of the more proficient CE users here, use this program as the basis for a tutorial on how to defeat DMA? Please.

Download Link : mihd.net/q6d21xc

Hint : Use 4 bytes, unknown value search. Exact value searches won't work.

Used GameMaker 6.1 so this program only works in win9x win2k winxp,
does not work in vista.
How do I find the pointer address for this?

[hcavolsdsadgadsg]

Right click your address once you find it, right click and find what writes to it. Search what 'more information' tells you, restart your game. Hopefully one will point to the right place.

there's tutorials on this lurking around the tutorial section.

[Dark Byte]

It all depends on how GameMaker works.
If it's a interpreter language instead of compiling the code, the addresses you'll find will be used by other parts of the game as well.

You could of course still use one of those addresses and write a code injection that then scans the memory region being accessed to determine what it is and act on that. (requires a bit more programming knowledge)

You could of course try the pointer scanner, and hope the game build's it up the same order each time.


Of course, if it isn't a interpreter but a compiler, then you should be fine with find what accesses/writes and play with the code

[random5566]

slovach :
I did that. Then I used "more information" and did a hex search for the
pointer address. It gave me hundreds of addresses. That's the problem.

Dark Byte :
I'm pretty sure GameMaker is interpreted, well the Game Maker Language part anyway. Actually Game Maker games normally do not
employ DMA. What I did to emulate DMA is kind of complicated.

If you're familiar with Mark Overmar's GM, what I did was use 2 objects.
Object1 creates a random value "randomx", then creates and destroys one instance of Object2 for "randomx" number of times. Object2 is the actual one that contains the random number to be hacked. This was the only way I know of to make a DMA-like program in GM. Maybe using GM wasn't such a good idea.

Anybody know of any small games or programs that use DMA? I'm having a hard time finding a small free DMA game to try hacking on.

[kjmarket]

Most of the time you won't find a static pointer on the first try. Nowadays it seems like its always multi-level pointers, meaning a pointer that points to a pointer. Check all those addresses you get the first time and if none of them are green, or static, you just have to manually search for a multi-level pointer. If you dont know how to find multilevel pointers, all you do is add one of or the only address that it gives as the pointer when you do the hex search and see what writes to that address. Try the pointer scan. It may not give you a static pointer, but it may give you a path to start on.

[random5566]

Forget about the GameMaker program, I've found a real game (a demo anyway) that uses DMA.

webpage :
sigma-team.net/#games/#action/#alien-shooter.#html

download link (7meg demo) :
sigma-team.net/#download-document/#alienshooter#demo.#html

remove/delete the "#" above, since for some reason I can't post
url's.

Could someone who knows how to bypass DMA please post a how-to using this game demo?
Finding the address for the money at the start of the demo game is easy, but for some reason I just can't find even one hex address for the value
posted in the "more information" window.

kjmarket :
I've done the tutorial.exe up to Step 7 on code injection, though I haven't done the Step 8 on Multilevel Pointers. It wouldn't make a difference in this case since everything learned in Step 6 on Pointers seems to be useless on this demo game "Alien Shooter".

[Labyrnth]

When you find what writes,reads or access's the address.
The instructions address you land at can be used, and will remain the same in most games. Thus defeating DMA.
If there is a code shift then that address you landed at will change as well.

Im getting this demo, maybe i can help you understand a bit more. "No promises since i have not ever seen this game."

Edit:
Ok, i was right, when you find what writes,reads or access's the address.
The address & instruction you land on, is what you need to defeat the DMA.
It is the same 2 instructions each time you restart the game.


So all you need to do is scan for your money.
You find 2 address's.
Find what writes to each one, and from there you can alter your assembly to cheat. edx & ebx hold the value of money after you buy a gun. So if you was to alter each register before it gets passed. You will have a cheat. And defeated DMA. As far s i can tell the game doesnt code shift.
Also, on this game it has several cfg files you can cheat there as well making weapons cost 0 etc...

[random5566]

Labyrnth :
Thanks for the heads up. So basically what you're saying is to use code injection (step 7 of the tutorial.exe) to defeat the dma in this game.
I've successfully done it. Thanks for the assist.

I didn't know you could change the cfg files, never looked in the games directory, eh wouldn't that be cheating ??

[Labyrnth]

Hahah yeah it would! ooops. Did we just say that out load?

Now if you ever run across instructions address change after closing the game and reopening it, you will be getting a code shift. Then you have to do some steps to get that corrected.

Thats the difference in the 2, some say there is no such thing, only DMA.
But they are free to believe what ever they want.

[24653187]

[HARDCORE-NL]

forget the methods you guys mentioned, just search in double for the value.
if you restart testdma again, you still got the same address

[24653187]

[Labyrnth]

[24653187]

[Labyrnth]

You would have to try it and see, trial and error best way to find out.